Several fixes related to the entrypoint value for the macho module

VirusTotal / yara

The pattern matching swiss knife

https://virustotal.github.io/yara/

BSD 3-Clause "New" or "Revised" License

7.95k stars 1.42k forks source link

Closed vthib closed 8 months ago

vthib commented 8 months ago

Those fixes are mostly related to the macho module with the PROCESS_MEMORY flag, but not only:

Add base_address to entrypoint if using PROCESS_MEMORY
Fix the computation of the entrypoint from a load command when using PROCESS_MEMORY
Do not set invalid entrypoint value if the unixthread command is too short

Would be great to get those fixes in 4.4